From 7c756181175d50200be487affa905e973f6cbaf5 Mon Sep 17 00:00:00 2001 From: Jaidev Shastri Date: Mon, 21 Sep 2026 21:16:54 -0400 Subject: [PATCH] pstore: publish big_oops_buf after max_compressed_size allocate_buf_for_compression() stores big_oops_buf and then max_compressed_size, both with plain stores. pstore_dump() runs from kmsg_dump on any CPU, tests big_oops_buf without psinfo_lock and then reads max_compressed_size. Store the size first and publish the buffer with smp_store_release(), paired with smp_load_acquire() in pstore_dump(). Found with MBCheck, a static herd7-based memory consistency checker. Signed-off-by: Jaidev Shastri Link: https://patch.msgid.link/20260921-mb-pstore-v1-1-46f9a6129d58@vt.edu Signed-off-by: Kees Cook --- fs/pstore/platform.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c index 1d76c9d92056..1ad6e40f4952 100644 --- a/fs/pstore/platform.c +++ b/fs/pstore/platform.c @@ -240,9 +240,14 @@ static void allocate_buf_for_compression(void) return; } - /* A non-NULL big_oops_buf indicates compression is available. */ - big_oops_buf = buf; max_compressed_size = compressed_size; + /* + * A non-NULL big_oops_buf indicates compression is available. + * pstore_dump() tests it without psinfo_lock and then reads + * max_compressed_size, which is stored above. Publish the buffer + * with release semantics. + */ + smp_store_release(&big_oops_buf, buf); pr_info("Using crash dump compression: %s\n", compress); } @@ -316,7 +321,8 @@ static void pstore_dump(struct kmsg_dumper *dumper, record.part = part; record.buf = psinfo->buf; - dst = big_oops_buf ?: psinfo->buf; + /* Pairs with the smp_store_release() in allocate_buf_for_compression(). */ + dst = smp_load_acquire(&big_oops_buf) ?: psinfo->buf; dst_size = max_compressed_size ?: psinfo->bufsize; /* Write dump header. */